Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Windows 7 Weißer Bildschirm... Abgesicherter Modus geht nicht (https://www.trojaner-board.de/139221-windows-7-weisser-bildschirm-abgesicherter-modus-geht.html)

StickerWerkZ 02.08.2013 16:14
Windows 7 Weißer Bildschirm... Abgesicherter Modus geht nicht
 
Hallo, habe folgendes Problem, gestern abend habe ich meinen pc ganz normal herruntergefahren und es war nichts auffälliges!
Heute mache ich ihn an und er fährt hoch und es kommt nur ein weißer Bildschirm, ich hatte schonmal so ein Virus, aber da kam etwas wegen Geld bezahlen und der war schnell weg!

Habe mir jetzt das FRST64 herruntergeladen und es durchlaufen lassen!

was muss ich jetzt tun?

Bitte um Hilfe, ich bin in der Werbebeschriftung selbstständig und habe viele wichtige Datein auf dem rechner.

Vielen Dank

markusg 02.08.2013 16:15
Hi,
da wir keine Hellseher sind, musst du uns das Log schon posten.

StickerWerkZ 02.08.2013 16:23
Hoffe das so richtig


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013
Ran by SYSTEM on 02-08-2013 17:03:55
Running from G:\
Windows 7 Ultimate (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM\...\Run: [Bdagent] - C:\Program Files\Bitdefender\Bitdefender\bdagent.exe [1716832 2013-06-27] (Bitdefender)
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2004-06-16] (InstallShield Software Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-05-20] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] -  [x]
HKU\Daniel\...\Run: [ISUSPM Startup] - C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe [221184 2004-06-16] (InstallShield Software Corporation)
HKU\Daniel\...\Run: [AdobeBridge] -  [x]
HKU\Daniel\...\Run: [Bitdefender-Geldbörse-Agent] - C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe [520496 2013-06-19] (Bitdefender)
HKU\Daniel\...\Run: [Bitdefender-Geldbörse] - C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe [971136 2013-06-20] (Bitdefender)
HKU\Daniel\...\Run: [Bitdefender-Geldbörse-Anwendungs-Agent] - C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe [609576 2013-06-19] (Bitdefender)
HKU\Daniel\...\Winlogon: [Shell] explorer.exe,C:\Users\Daniel\AppData\Roaming\data.dat <==== ATTENTION
AppInit_DLLs-x32:  [0 ] ()
Startup: C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender\bdparentalservice.exe [75584 2013-06-19] (Bitdefender)
S2 MSSQL$ZOOM; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S2 UnsignedThemes; C:\Windows\UnsignedThemesSvc.exe [24168 2009-07-13] (The Within Network, LLC)
S2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe [67320 2013-06-19] (Bitdefender)
S2 VSSERV; C:\Program Files\Bitdefender\Bitdefender\vsserv.exe [1502080 2013-06-20] (Bitdefender)

==================== Drivers (Whitelisted) ====================

S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2009-04-06] ()
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2009-04-06] ()
S0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [718840 2013-04-17] (BitDefender)
S3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [593144 2013-04-17] (BitDefender)
S1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-02-22] (BitDefender LLC)
S1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 bdfwfpf_pc; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [109056 2013-01-29] (BitDefender SRL)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82384 2012-11-12] (BitDefender SRL)
S0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [147232 2012-10-04] (BitDefender LLC)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] ()
S0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [383048 2013-01-28] (BitDefender S.R.L.)
S2 uxpatch; C:\Windows\system32\drivers\uxpatch.sys [30568 2009-07-13] ()
S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 JavaQuickStarterService;
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-31 18:34 - 2013-07-31 18:34 - 00028457 _____ C:\Users\Daniel\Downloads\honda_motor_co_125728.zip
2013-07-30 16:54 - 2013-07-30 16:54 - 00163392 _____ () C:\Users\Daniel\Downloads\NimbusSansBeckerDiaD_downloader_by_Fonts101.exe
2013-07-30 16:09 - 2013-07-30 16:09 - 00006102 _____ C:\Users\Daniel\Downloads\R32-vector-logo-C1E02B2EF4-seeklogo.com.zip
2013-07-30 16:09 - 2013-07-30 16:09 - 00000000 ____D C:\Users\Daniel\Downloads\R32-vector-logo-C1E02B2EF4-seeklogo.com
2013-07-28 19:19 - 2013-07-28 19:19 - 00111087 _____ C:\Users\Daniel\Downloads\ethnocentric.zip
2013-07-28 19:17 - 2013-07-28 19:17 - 00461024 _____ C:\Users\Daniel\Downloads\player_1_up.zip
2013-07-28 15:47 - 2013-07-28 15:47 - 00010372 _____ C:\Users\Daniel\Desktop\Unbenannt-1.svg
2013-07-28 14:50 - 2013-07-28 14:50 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Canneverbe Limited
2013-07-28 14:50 - 2013-07-28 14:50 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-07-28 14:47 - 2013-07-28 14:47 - 00054193 _____ C:\Users\Daniel\Downloads\techno-overload-brk.zip
2013-07-28 14:47 - 2013-07-28 14:47 - 00017466 _____ C:\Users\Daniel\Downloads\feuerfeste.zip
2013-07-28 14:43 - 2013-07-28 14:43 - 00000000 ____D C:\Users\Daniel\Downloads\Font.Portfolio.MULTiLANGUAGE-RESTORE
2013-07-28 14:24 - 2013-07-28 14:27 - 107260395 _____ C:\Users\Daniel\Downloads\T100.rar
2013-07-28 14:23 - 2013-07-28 14:24 - 06917747 _____ C:\Users\Daniel\Downloads\100-Beste-Schriften-Buch.rar
2013-07-28 13:48 - 2013-07-28 14:01 - 270000000 _____ C:\Users\Daniel\Downloads\Font.Portfolio.MULTiLANGUAGE-RESTORE.part1.rar
2013-07-28 13:48 - 2013-07-28 13:51 - 37176878 _____ C:\Users\Daniel\Downloads\Font.Portfolio.MULTiLANGUAGE-RESTORE.part2.rar
2013-07-27 13:40 - 2013-07-27 13:40 - 00007039 _____ C:\Users\Daniel\Downloads\Opel-vector-logo-6A434A4A7F-seeklogo.com.zip
2013-07-25 13:08 - 2013-07-25 13:08 - 00045185 _____ C:\Users\Daniel\Downloads\elegant.zip
2013-07-25 13:00 - 2013-07-25 13:00 - 00036079 _____ C:\Users\Daniel\Downloads\jane_austen.zip
2013-07-21 23:57 - 2013-07-21 23:57 - 00002033 _____ C:\Users\Public\Desktop\Silhouette Studio.lnk
2013-07-21 23:57 - 2013-07-21 23:57 - 00000000 ____D C:\Program Files (x86)\Silhouette Studio
2013-07-21 20:26 - 2013-07-21 20:44 - 86610376 _____ (Aspex Research & Technology) C:\Users\Daniel\Downloads\silhouette-studio_v2.8.4.exe
2013-07-20 18:29 - 2013-07-20 18:29 - 00021315 _____ C:\Users\Daniel\Downloads\puzzle.zip
2013-07-20 18:29 - 2013-07-20 18:29 - 00000000 ____D C:\Users\Daniel\Downloads\puzzle
2013-07-20 14:27 - 2013-07-20 14:27 - 01024035 _____ C:\Users\Daniel\Downloads\ruthless_two.zip
2013-07-20 14:26 - 2013-07-20 14:26 - 01008205 _____ C:\Users\Daniel\Downloads\ruthless_one.zip
2013-07-18 11:53 - 2013-07-24 16:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-07-17 23:05 - 2013-07-24 22:29 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\HpUpdate
2013-07-17 23:05 - 2013-07-17 23:05 - 00000000 ____D C:\Windows\Hewlett-Packard
2013-07-16 11:01 - 2013-07-16 11:01 - 00000000 ____D C:\Users\Daniel\Desktop\Aufkleber Bilder
2013-07-16 01:45 - 2013-07-16 01:45 - 00002000 _____ C:\Users\Public\Desktop\FileZilla Client.lnk
2013-07-16 01:44 - 2013-07-16 01:45 - 04815135 _____ (FileZilla Project) C:\Users\Daniel\Downloads\FileZilla_3.7.1_win32-setup.exe
2013-07-16 01:09 - 2013-07-16 01:09 - 00000000 ____D C:\Users\Daniel\Documents\Eigene Scans
2013-07-15 15:36 - 2013-07-15 15:36 - 00477274 _____ C:\Users\Daniel\Downloads\vauwerksfinal (1).eps
2013-07-15 15:36 - 2013-07-15 15:36 - 00368474 _____ C:\Users\Daniel\Downloads\canibeat (1).eps
2013-07-13 10:32 - 2013-07-13 10:32 - 00076944 _____ (BitDefender) C:\Windows\System32\Drivers\bdvedisk.sys
2013-07-13 09:53 - 2013-07-13 09:53 - 00000000 ____D C:\Program Files\Microsoft Mouse and Keyboard Center
2013-07-13 09:52 - 2013-07-13 09:55 - 00000000 ____D C:\Windows\System32\MRT
2013-07-13 00:19 - 2013-07-13 00:19 - 01398668 _____ C:\ProgramData\1373670480.bdinstall.bin
2013-07-13 00:14 - 2013-07-13 00:14 - 00000385 _____ C:\Windows\System32\user_gensett.xml
2013-07-13 00:14 - 2013-07-13 00:14 - 00000385 _____ C:\Users\Daniel\AppData\Roaminguser_gensett.xml
2013-07-13 00:13 - 2013-07-13 00:13 - 00002186 _____ C:\Users\Public\Desktop\Bitdefender Safepay.lnk
2013-07-13 00:13 - 2013-07-13 00:13 - 00002067 _____ C:\Users\Public\Desktop\Bitdefender Internet Security.lnk
2013-07-13 00:13 - 2013-07-13 00:13 - 00000684 ____H C:\bdr-cf01
2013-07-13 00:13 - 2013-07-13 00:13 - 00000000 ____H C:\Windows\System32\Drivers\Msft_Kernel_avchv_01009.Wdf
2013-07-13 00:13 - 2013-07-13 00:13 - 00000000 ____D C:\ProgramData\BDLogging
2013-07-13 00:13 - 2013-04-17 13:59 - 00718840 _____ (BitDefender) C:\Windows\System32\Drivers\avc3.sys
2013-07-13 00:13 - 2013-04-17 13:59 - 00593144 _____ (BitDefender) C:\Windows\System32\Drivers\avckf.sys
2013-07-13 00:13 - 2013-02-22 18:46 - 00093600 _____ (BitDefender LLC) C:\Windows\System32\Drivers\BdfNdisf6.sys
2013-07-13 00:13 - 2012-11-12 17:11 - 00082384 _____ (BitDefender SRL) C:\Windows\System32\Drivers\bdsandbox.sys
2013-07-13 00:13 - 2012-11-02 13:17 - 00261056 _____ (BitDefender) C:\Windows\System32\Drivers\avchv.sys
2013-07-13 00:13 - 2007-04-11 10:11 - 00511328 _____ (Microsoft Corporation) C:\Windows\capicom.dll
2013-07-13 00:12 - 2013-07-13 00:13 - 00253404 ____H C:\bdr-ld01
2013-07-13 00:12 - 2013-07-13 00:13 - 00009216 ____H C:\bdr-ld01.mbr
2013-07-13 00:12 - 2013-07-13 00:12 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Bitdefender
2013-07-13 00:12 - 2013-06-25 17:20 - 38518480 ____H C:\bdr-im01.gz
2013-07-13 00:12 - 2012-08-15 14:28 - 02510608 ____H C:\bdr-bz01
2013-07-13 00:09 - 2013-07-13 00:09 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\QuickScan
2013-07-13 00:08 - 2013-07-13 00:14 - 00000000 ____D C:\ProgramData\Bitdefender
2013-07-13 00:08 - 2013-07-13 00:08 - 00000000 ____D C:\Program Files\Bitdefender
2013-07-13 00:08 - 2013-01-28 14:57 - 00383048 _____ (BitDefender S.R.L.) C:\Windows\System32\Drivers\trufos.sys
2013-07-13 00:08 - 2012-10-04 13:30 - 00147232 _____ (BitDefender LLC) C:\Windows\System32\Drivers\gzflt.sys
2013-07-13 00:07 - 2013-07-16 12:45 - 00000666 _____ C:\Windows\PFRO.log
2013-07-12 23:46 - 2013-07-13 00:08 - 00000000 ____D C:\Program Files\Common Files\Bitdefender
2013-07-11 20:47 - 2013-07-11 20:48 - 00000000 ____D C:\Windows\System32\appmgmt
2013-07-10 21:32 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2013-07-10 21:32 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 21:32 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-10 21:32 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 21:27 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-07-10 21:26 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 21:26 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-07-10 21:18 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 21:18 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 21:18 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 21:18 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 21:18 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 21:18 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 21:18 - 2013-06-12 00:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 21:18 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 21:18 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 21:18 - 2013-06-12 00:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 21:18 - 2013-06-12 00:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-10 21:18 - 2013-06-12 00:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-10 21:18 - 2013-06-12 00:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-10 21:18 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-10 21:18 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-10 21:18 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-10 21:18 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-10 21:18 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-10 21:18 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-10 21:18 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-10 21:18 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-10 21:18 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-10 21:18 - 2013-06-12 00:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-10 21:18 - 2013-06-12 00:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-07-10 21:18 - 2013-06-12 00:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-07-10 21:18 - 2013-06-12 00:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-10 21:18 - 2013-06-12 00:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-07-10 21:18 - 2013-06-11 23:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-10 21:18 - 2013-06-11 23:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-10 21:18 - 2013-06-07 04:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-10 21:18 - 2013-06-07 03:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 15:06 - 2013-07-10 15:06 - 00477274 _____ C:\Users\Daniel\Downloads\vauwerksfinal.eps
2013-07-10 15:06 - 2013-07-10 15:06 - 00368474 _____ C:\Users\Daniel\Downloads\canibeat.eps
2013-07-09 12:21 - 2013-07-09 12:21 - 00000000 ____D C:\Program Files (x86)\SweetIM
2013-07-09 12:20 - 2013-07-10 21:08 - 00000000 ____D C:\Windows\SysWOW64\WNLT
2013-07-04 18:49 - 2013-08-02 15:26 - 00003562 _____ C:\Windows\setupact.log
2013-07-04 18:49 - 2013-07-04 18:49 - 00000000 _____ C:\Windows\setuperr.log
2013-07-04 18:48 - 2013-07-11 20:48 - 00000000 ____D C:\Program Files (x86)\Dr. Hardware 2013
2013-07-04 18:48 - 2011-12-06 10:26 - 00014760 _____ C:\Windows\System32\Drivers\DRHMSR64.sys
2013-07-04 18:48 - 2011-11-03 17:05 - 00021984 _____ (Licensed for Gebhard Software) C:\Windows\System32\Drivers\DRHARD64.sys
2013-07-04 18:43 - 2013-07-04 18:43 - 00002774 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-07-04 18:43 - 2013-07-04 18:43 - 00000000 ____D C:\Program Files\CCleaner
197

==================== One Month Modified Files and Folders =======

2013-08-02 15:27 - 2013-03-14 19:42 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-02 15:26 - 2013-07-04 18:49 - 00003562 _____ C:\Windows\setupact.log
2013-08-02 15:26 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-01 22:03 - 2013-03-14 16:39 - 01922660 _____ C:\Windows\WindowsUpdate.log
2013-08-01 22:02 - 2013-03-14 19:42 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-01 21:12 - 2013-03-16 01:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-01 01:00 - 2013-03-17 19:39 - 00000000 ____D C:\Users\Daniel\AppData\Local\Adobe
2013-08-01 00:05 - 2013-03-14 19:45 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-31 19:25 - 2013-03-14 21:16 - 00000000 ____D C:\Users\Daniel\Desktop\Sticker.WerkZ
2013-07-31 18:34 - 2013-07-31 18:34 - 00028457 _____ C:\Users\Daniel\Downloads\honda_motor_co_125728.zip
2013-07-31 13:49 - 2009-07-14 05:45 - 00013536 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-31 13:49 - 2009-07-14 05:45 - 00013536 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-31 13:42 - 2009-07-14 05:45 - 05048256 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-30 16:54 - 2013-07-30 16:54 - 00163392 _____ () C:\Users\Daniel\Downloads\NimbusSansBeckerDiaD_downloader_by_Fonts101.exe
2013-07-30 16:09 - 2013-07-30 16:09 - 00006102 _____ C:\Users\Daniel\Downloads\R32-vector-logo-C1E02B2EF4-seeklogo.com.zip
2013-07-30 16:09 - 2013-07-30 16:09 - 00000000 ____D C:\Users\Daniel\Downloads\R32-vector-logo-C1E02B2EF4-seeklogo.com
2013-07-30 15:01 - 2013-03-14 19:42 - 00109472 _____ C:\Users\Daniel\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-28 19:19 - 2013-07-28 19:19 - 00111087 _____ C:\Users\Daniel\Downloads\ethnocentric.zip
2013-07-28 19:17 - 2013-07-28 19:17 - 00461024 _____ C:\Users\Daniel\Downloads\player_1_up.zip
2013-07-28 15:47 - 2013-07-28 15:47 - 00010372 _____ C:\Users\Daniel\Desktop\Unbenannt-1.svg
2013-07-28 14:50 - 2013-07-28 14:50 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Canneverbe Limited
2013-07-28 14:50 - 2013-07-28 14:50 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-07-28 14:47 - 2013-07-28 14:47 - 00054193 _____ C:\Users\Daniel\Downloads\techno-overload-brk.zip
2013-07-28 14:47 - 2013-07-28 14:47 - 00017466 _____ C:\Users\Daniel\Downloads\feuerfeste.zip
2013-07-28 14:43 - 2013-07-28 14:43 - 00000000 ____D C:\Users\Daniel\Downloads\Font.Portfolio.MULTiLANGUAGE-RESTORE
2013-07-28 14:27 - 2013-07-28 14:24 - 107260395 _____ C:\Users\Daniel\Downloads\T100.rar
2013-07-28 14:24 - 2013-07-28 14:23 - 06917747 _____ C:\Users\Daniel\Downloads\100-Beste-Schriften-Buch.rar
2013-07-28 14:01 - 2013-07-28 13:48 - 270000000 _____ C:\Users\Daniel\Downloads\Font.Portfolio.MULTiLANGUAGE-RESTORE.part1.rar
2013-07-28 13:51 - 2013-07-28 13:48 - 37176878 _____ C:\Users\Daniel\Downloads\Font.Portfolio.MULTiLANGUAGE-RESTORE.part2.rar
2013-07-27 13:40 - 2013-07-27 13:40 - 00007039 _____ C:\Users\Daniel\Downloads\Opel-vector-logo-6A434A4A7F-seeklogo.com.zip
2013-07-25 13:08 - 2013-07-25 13:08 - 00045185 _____ C:\Users\Daniel\Downloads\elegant.zip
2013-07-25 13:00 - 2013-07-25 13:00 - 00036079 _____ C:\Users\Daniel\Downloads\jane_austen.zip
2013-07-24 22:29 - 2013-07-17 23:05 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\HpUpdate
2013-07-24 16:33 - 2013-07-18 11:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-07-22 14:00 - 2013-03-17 19:50 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-07-21 23:57 - 2013-07-21 23:57 - 00002033 _____ C:\Users\Public\Desktop\Silhouette Studio.lnk
2013-07-21 23:57 - 2013-07-21 23:57 - 00000000 ____D C:\Program Files (x86)\Silhouette Studio
2013-07-21 23:56 - 2013-03-14 20:22 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Aspex Research & Technology
2013-07-21 20:44 - 2013-07-21 20:26 - 86610376 _____ (Aspex Research & Technology) C:\Users\Daniel\Downloads\silhouette-studio_v2.8.4.exe
2013-07-21 14:47 - 2013-05-20 17:09 - 00000000 ____D C:\Users\Daniel\Desktop\Homepage
2013-07-20 18:29 - 2013-07-20 18:29 - 00021315 _____ C:\Users\Daniel\Downloads\puzzle.zip
2013-07-20 18:29 - 2013-07-20 18:29 - 00000000 ____D C:\Users\Daniel\Downloads\puzzle
2013-07-20 15:54 - 2013-03-14 19:48 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Adobe
2013-07-20 14:27 - 2013-07-20 14:27 - 01024035 _____ C:\Users\Daniel\Downloads\ruthless_two.zip
2013-07-20 14:26 - 2013-07-20 14:26 - 01008205 _____ C:\Users\Daniel\Downloads\ruthless_one.zip
2013-07-18 18:35 - 2013-06-21 14:05 - 00000132 _____ C:\Users\Daniel\AppData\Roaming\Adobe CS6-PNG-Format - Voreinstellungen
2013-07-17 23:06 - 2013-03-14 19:47 - 00000000 ____D C:\Program Files (x86)\HP
2013-07-17 23:05 - 2013-07-17 23:05 - 00000000 ____D C:\Windows\Hewlett-Packard
2013-07-16 12:45 - 2013-07-13 00:07 - 00000666 _____ C:\Windows\PFRO.log
2013-07-16 11:01 - 2013-07-16 11:01 - 00000000 ____D C:\Users\Daniel\Desktop\Aufkleber Bilder
2013-07-16 02:08 - 2013-05-20 17:09 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\FileZilla
2013-07-16 01:45 - 2013-07-16 01:45 - 00002000 _____ C:\Users\Public\Desktop\FileZilla Client.lnk
2013-07-16 01:45 - 2013-07-16 01:44 - 04815135 _____ (FileZilla Project) C:\Users\Daniel\Downloads\FileZilla_3.7.1_win32-setup.exe
2013-07-16 01:45 - 2013-05-20 17:09 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-07-16 01:09 - 2013-07-16 01:09 - 00000000 ____D C:\Users\Daniel\Documents\Eigene Scans
2013-07-15 15:36 - 2013-07-15 15:36 - 00477274 _____ C:\Users\Daniel\Downloads\vauwerksfinal (1).eps
2013-07-15 15:36 - 2013-07-15 15:36 - 00368474 _____ C:\Users\Daniel\Downloads\canibeat (1).eps
2013-07-14 18:41 - 2013-05-21 18:53 - 00000000 ____D C:\Users\Daniel\AppData\Local\Thunderbird
2013-07-14 11:29 - 2013-03-16 01:56 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-14 11:29 - 2013-03-16 01:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-14 11:29 - 2013-03-16 01:56 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-13 10:32 - 2013-07-13 10:32 - 00076944 _____ (BitDefender) C:\Windows\System32\Drivers\bdvedisk.sys
2013-07-13 10:03 - 2013-04-27 21:15 - 00000000 ____D C:\Users\Daniel\Desktop\Neuer Ordner
2013-07-13 09:57 - 2013-03-14 19:42 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-13 09:57 - 2013-03-14 19:42 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-13 09:55 - 2013-07-13 09:52 - 00000000 ____D C:\Windows\System32\MRT
2013-07-13 09:54 - 2013-03-21 17:32 - 00003062 _____ C:\Windows\System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe
2013-07-13 09:54 - 2013-03-21 17:32 - 00003060 _____ C:\Windows\System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe
2013-07-13 09:53 - 2013-07-13 09:53 - 00000000 ____D C:\Program Files\Microsoft Mouse and Keyboard Center
2013-07-13 09:47 - 2009-07-14 18:58 - 00702752 _____ C:\Windows\System32\perfh007.dat
2013-07-13 09:47 - 2009-07-14 18:58 - 00147958 _____ C:\Windows\System32\perfc007.dat
2013-07-13 09:47 - 2009-07-14 06:13 - 01654228 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-13 00:36 - 2013-03-14 19:55 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2013-07-13 00:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-07-13 00:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2013-07-13 00:19 - 2013-07-13 00:19 - 01398668 _____ C:\ProgramData\1373670480.bdinstall.bin
2013-07-13 00:19 - 2013-05-22 16:34 - 00000000 ____D C:\Users\Daniel\Desktop\StickerWerkZ Shop
2013-07-13 00:18 - 2013-04-05 21:13 - 00000000 ____D C:\Users\Daniel\AppData\Local\Facebook
2013-07-13 00:14 - 2013-07-13 00:14 - 00000385 _____ C:\Windows\System32\user_gensett.xml
2013-07-13 00:14 - 2013-07-13 00:14 - 00000385 _____ C:\Users\Daniel\AppData\Roaminguser_gensett.xml
2013-07-13 00:14 - 2013-07-13 00:08 - 00000000 ____D C:\ProgramData\Bitdefender
2013-07-13 00:13 - 2013-07-13 00:13 - 00002186 _____ C:\Users\Public\Desktop\Bitdefender Safepay.lnk
2013-07-13 00:13 - 2013-07-13 00:13 - 00002067 _____ C:\Users\Public\Desktop\Bitdefender Internet Security.lnk
2013-07-13 00:13 - 2013-07-13 00:13 - 00000684 ____H C:\bdr-cf01
2013-07-13 00:13 - 2013-07-13 00:13 - 00000000 ____H C:\Windows\System32\Drivers\Msft_Kernel_avchv_01009.Wdf
2013-07-13 00:13 - 2013-07-13 00:13 - 00000000 ____D C:\ProgramData\BDLogging
2013-07-13 00:13 - 2013-07-13 00:12 - 00253404 ____H C:\bdr-ld01
2013-07-13 00:13 - 2013-07-13 00:12 - 00009216 ____H C:\bdr-ld01.mbr
2013-07-13 00:12 - 2013-07-13 00:12 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Bitdefender
2013-07-13 00:09 - 2013-07-13 00:09 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\QuickScan
2013-07-13 00:08 - 2013-07-13 00:08 - 00000000 ____D C:\Program Files\Bitdefender
2013-07-13 00:08 - 2013-07-12 23:46 - 00000000 ____D C:\Program Files\Common Files\Bitdefender
2013-07-12 23:38 - 2013-03-14 19:55 - 00000000 ____D C:\ProgramData\Yahoo! Companion
2013-07-12 23:37 - 2013-03-14 19:00 - 00000000 ____D C:\users\Daniel
2013-07-11 20:50 - 2013-03-14 19:46 - 00003283 _____ C:\ProgramData\hpzinstall.log
2013-07-11 20:48 - 2013-07-11 20:47 - 00000000 ____D C:\Windows\System32\appmgmt
2013-07-11 20:48 - 2013-07-04 18:48 - 00000000 ____D C:\Program Files (x86)\Dr. Hardware 2013
2013-07-11 20:47 - 2013-06-14 04:36 - 00000000 ____D C:\Program Files (x86)\ASUS
2013-07-11 20:47 - 2013-04-02 05:38 - 00000000 ____D C:\Program Files (x86)\2zoom
2013-07-11 20:47 - 2013-03-14 19:18 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-11 02:16 - 2009-07-14 19:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 02:16 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 02:16 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 21:29 - 2013-03-14 16:36 - 00000000 ____D C:\Windows\Panther
2013-07-10 21:08 - 2013-07-09 12:20 - 00000000 ____D C:\Windows\SysWOW64\WNLT
2013-07-10 21:08 - 2013-03-14 19:44 - 00000000 ____D C:\ProgramData\HP
2013-07-10 21:08 - 2013-03-14 19:19 - 00000000 ____D C:\ProgramData\InstallShield
2013-07-10 21:08 - 2009-07-14 19:18 - 00000000 ____D C:\Windows\ShellNew
2013-07-10 15:06 - 2013-07-10 15:06 - 00477274 _____ C:\Users\Daniel\Downloads\vauwerksfinal.eps
2013-07-10 15:06 - 2013-07-10 15:06 - 00368474 _____ C:\Users\Daniel\Downloads\canibeat.eps
2013-07-09 12:21 - 2013-07-09 12:21 - 00000000 ____D C:\Program Files (x86)\SweetIM
2013-07-04 18:49 - 2013-07-04 18:49 - 00000000 _____ C:\Windows\setuperr.log
2013-07-04 18:45 - 2013-03-14 18:55 - 00000000 ____D C:\Windows\Minidump
2013-07-04 18:43 - 2013-07-04 18:43 - 00002774 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-07-04 18:43 - 2013-07-04 18:43 - 00000000 ____D C:\Program Files\CCleaner

Files to move or delete:
====================
C:\ProgramData\aejirb.pad
C:\Users\Daniel\AppData\Roaming\cache.dat

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-07-13 09:45:39
Restore point made on: 2013-07-13 09:59:51
Restore point made on: 2013-07-20 19:32:35
Restore point made on: 2013-07-21 23:57:04
Restore point made on: 2013-07-29 23:00:16

==================== Memory info ===========================

Percentage of memory in use: 16%
Total physical RAM: 4095.3 MB
Available physical RAM: 3425.7 MB
Total Pagefile: 4093.45 MB
Available Pagefile: 3428.79 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.76 GB) (Free:407.38 GB) NTFS (Disk=1 Partition=1)
Drive e: (Bilder - Filme - Musik) (Fixed) (Total:488.28 GB) (Free:287.33 GB) NTFS (Disk=0 Partition=2)
Drive f: (GRMCULXFRER_DE_DVD) (CDROM) (Total:3.76 GB) (Free:0 GB) UDF
Drive g: () (Removable) (Total:3.75 GB) (Free:3.63 GB) FAT32 (Disk=2 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: () (Fixed) (Total:443.23 GB) (Free:443.08 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 4A53B33F)
Partition 1: (Active) - (Size=443 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=488 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 0D5D0D5D)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 4 GB) (Disk ID: 49BE8E81)
Partition 1: (Not Active) - (Size=4 GB) - (Type=0B)


LastRegBack: 2013-07-22 23:23

==================== End Of Log ============================
--- --- ---

markusg 02.08.2013 16:26
Hi,
1.
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\Daniel\...\Winlogon: [Shell] explorer.exe,C:\Users\Daniel\AppData\Roaming\data.dat <==== ATTENTION
C:\ProgramData\aejirb.pad
C:\Users\Daniel\AppData\Roaming\cache.dat
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

sollte der Start in den normalen Modus klappen:
2.

Navigiere bitte zu:
C:\FRST\Quarantine
Rechtsklick, mit Winrar oder einem anderen Archvierer packen und im Uploadchannel hochladen.
Trojaner-Board Upload Channel

StickerWerkZ 02.08.2013 16:32
das kommt jetzt

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-08-2013
Ran by SYSTEM at 2013-08-02 17:30:19 Run:1
Running from G:\
Boot Mode: Recovery
==============================================

HKU\Daniel\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\ProgramData\aejirb.pad => Moved successfully.
C:\Users\Daniel\AppData\Roaming\cache.dat => Moved successfully.

==== End of Fixlog ====

markusg 02.08.2013 16:33
das ist jetzt nur punkt 1 von 2, was ist mit dem Rest?
bitte alles nacheinander abarbeiten, dann infos posten.

StickerWerkZ 02.08.2013 16:34
okay sorry, bin dabei

markusg 02.08.2013 16:42
Hi, bitte keine Posts wie, "ich bin dabei" neue werden an diesen angehangen, und ich muss dann immer hier reingucken.
Wenn du fertig bist mit Uploaden, und im normalen modus:
Es sind 2 Logs zu erstellen, poste diese gleichzeitig.
1.
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.



2.b
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


StickerWerkZ 02.08.2013 18:10
hier das erste:
Code:
ComboFix 13-08-01.01 - Daniel 02.08.2013  18:02:46.1.2 - x64
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.4095.2564 [GMT 2:00]
ausgeführt von:: c:\users\Daniel\Downloads\ComboFix.exe
AV: Bitdefender Antivirus *Enabled/Updated* {9B5F5313-CAF9-DD97-C460-E778420237B4}
FW: Bitdefender Firewall *Disabled* {A364D236-8096-DCCF-EF3F-4E4DBCD170CF}
SP: Bitdefender Spyware-Schutz *Enabled/Updated* {203EB2F7-ECC3-D219-FED0-DC0A39857D09}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\1373670480.bdinstall.bin
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-07-02 bis 2013-08-02  ))))))))))))))))))))))))))))))
.
.
2013-08-02 16:09 . 2013-08-02 16:09        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-08-02 16:03 . 2013-08-02 15:49        --------        d-----w-        C:\FRST
2013-07-28 13:50 . 2013-07-28 13:50        --------        d-----w-        c:\programdata\Canneverbe Limited
2013-07-28 13:50 . 2013-07-28 13:50        --------        d-----w-        c:\users\Daniel\AppData\Roaming\Canneverbe Limited
2013-07-27 18:26 . 2013-07-27 18:26        --------        d-----w-        c:\program files (x86)\CDBurnerXP
2013-07-27 17:45 . 2013-07-27 17:45        --------        d-----w-        c:\users\Daniel\AppData\Roaming\DivX
2013-07-21 22:57 . 2013-07-21 22:57        --------        d-----w-        c:\program files (x86)\Silhouette Studio
2013-07-18 10:53 . 2013-07-24 15:33        --------        d-----w-        c:\program files (x86)\Mozilla Thunderbird
2013-07-17 22:05 . 2013-07-24 21:29        --------        d-----w-        c:\users\Daniel\AppData\Roaming\HpUpdate
2013-07-17 22:05 . 2013-07-17 22:05        --------        d-----w-        c:\windows\Hewlett-Packard
2013-07-13 09:32 . 2013-07-13 09:32        76944        ----a-w-        c:\windows\system32\drivers\bdvedisk.sys
2013-07-13 08:53 . 2013-07-13 08:53        --------        d-----w-        c:\program files\Microsoft Mouse and Keyboard Center
2013-07-13 08:52 . 2013-07-13 08:55        --------        d-----w-        c:\windows\system32\MRT
2013-07-12 23:13 . 2013-07-12 23:13        --------        d-----w-        c:\programdata\BDLogging
2013-07-12 23:13 . 2013-02-22 17:46        93600        ----a-w-        c:\windows\system32\drivers\BdfNdisf6.sys
2013-07-12 23:13 . 2012-11-12 16:11        82384        ----a-w-        c:\windows\system32\drivers\bdsandbox.sys
2013-07-12 23:13 . 2007-04-11 09:11        511328        ----a-w-        c:\windows\capicom.dll
2013-07-12 23:13 . 2013-04-17 12:59        593144        ----a-w-        c:\windows\system32\drivers\avckf.sys
2013-07-12 23:13 . 2013-04-17 12:59        718840        ----a-w-        c:\windows\system32\drivers\avc3.sys
2013-07-12 23:13 . 2012-11-02 12:17        261056        ----a-w-        c:\windows\system32\drivers\avchv.sys
2013-07-12 23:12 . 2013-07-12 23:12        --------        d-----w-        c:\users\Daniel\AppData\Roaming\Bitdefender
2013-07-12 23:09 . 2013-07-12 23:09        --------        d-----w-        c:\users\Daniel\AppData\Roaming\QuickScan
2013-07-12 23:08 . 2013-07-12 23:14        --------        d-----w-        c:\programdata\Bitdefender
2013-07-12 23:08 . 2012-10-04 12:30        147232        ----a-w-        c:\windows\system32\drivers\gzflt.sys
2013-07-12 23:08 . 2013-07-12 23:08        --------        d-----w-        c:\program files\Bitdefender
2013-07-12 23:08 . 2013-01-28 13:57        383048        ----a-w-        c:\windows\system32\drivers\trufos.sys
2013-07-12 22:46 . 2013-07-12 23:08        --------        d-----w-        c:\program files\Common Files\Bitdefender
2013-07-12 22:46 . 2013-07-12 22:46        --------        d-----w-        c:\program files (x86)\Common Files\Bitdefender
2013-07-11 19:47 . 2013-07-11 19:48        --------        d-----w-        c:\windows\system32\appmgmt
2013-07-11 15:11 . 2013-07-11 15:11        --------        d-----w-        c:\users\Daniel\AppData\Local\Programs
2013-07-10 20:33 . 2013-05-27 05:50        1011712        ----a-w-        c:\program files\Windows Defender\MpSvc.dll
2013-07-10 20:33 . 2013-05-27 05:50        571904        ----a-w-        c:\program files\Windows Defender\MpClient.dll
2013-07-10 20:33 . 2013-05-27 05:50        314880        ----a-w-        c:\program files\Windows Defender\MpCommu.dll
2013-07-10 20:33 . 2013-05-27 04:57        4608        ----a-w-        c:\program files (x86)\Windows Defender\MsMpLics.dll
2013-07-10 20:33 . 2013-05-27 04:57        54784        ----a-w-        c:\program files (x86)\Windows Defender\MpOAV.dll
2013-07-10 20:33 . 2013-05-27 04:57        392704        ----a-w-        c:\program files (x86)\Windows Defender\MpClient.dll
2013-07-10 20:33 . 2013-05-27 03:15        9216        ----a-w-        c:\program files (x86)\Windows Defender\MpAsDesc.dll
2013-07-10 20:32 . 2013-06-04 04:53        509440        ----a-w-        c:\windows\SysWow64\qedit.dll
2013-07-10 20:32 . 2013-06-04 06:00        624128        ----a-w-        c:\windows\system32\qedit.dll
2013-07-10 20:32 . 2013-05-06 06:03        1887744        ----a-w-        c:\windows\system32\WMVDECOD.DLL
2013-07-10 20:32 . 2013-05-06 04:56        1620480        ----a-w-        c:\windows\SysWow64\WMVDECOD.DLL
2013-07-10 20:27 . 2013-06-05 03:34        3153920        ----a-w-        c:\windows\system32\win32k.sys
2013-07-10 20:27 . 2013-04-10 05:48        1732608        ----a-w-        c:\program files\Windows Journal\NBDoc.DLL
2013-07-10 20:27 . 2013-04-10 05:46        1393152        ----a-w-        c:\program files\Windows Journal\JNTFiltr.dll
2013-07-10 20:27 . 2013-04-10 05:46        1367040        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 20:27 . 2013-04-10 05:03        936448        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 20:27 . 2013-04-10 05:46        1402880        ----a-w-        c:\program files\Windows Journal\JNWDRV.dll
2013-07-10 20:26 . 2013-04-09 23:34        1247744        ----a-w-        c:\windows\SysWow64\DWrite.dll
2013-07-10 20:26 . 2013-04-02 22:51        1643520        ----a-w-        c:\windows\system32\DWrite.dll
2013-07-09 11:21 . 2013-07-09 11:21        --------        d-----w-        c:\program files (x86)\SweetIM
2013-07-09 11:20 . 2013-07-10 20:08        --------        d-----w-        c:\windows\SysWow64\WNLT
2013-07-04 17:48 . 2011-12-06 09:26        14760        ----a-w-        c:\windows\system32\drivers\DRHMSR64.sys
2013-07-04 17:48 . 2011-11-03 16:05        21984        ----a-w-        c:\windows\system32\drivers\DRHARD64.sys
2013-07-04 17:48 . 2013-07-11 19:48        --------        d-----w-        c:\program files (x86)\Dr. Hardware 2013
2013-07-04 17:43 . 2013-07-04 17:43        --------        d-----w-        c:\program files\CCleaner
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-14 10:29 . 2013-03-16 00:56        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-14 10:29 . 2013-03-16 00:56        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-23 22:57 . 2013-03-14 17:57        78277128        ----a-w-        c:\windows\system32\MRT.exe
2013-06-21 01:20 . 2013-06-21 01:20        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll
2013-06-21 01:20 . 2013-06-21 01:20        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll
2013-06-21 01:20 . 2013-06-21 01:20        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll
2013-06-21 01:20 . 2013-06-21 01:20        226304        ----a-w-        c:\windows\system32\elshyph.dll
2013-06-21 01:20 . 2013-06-21 01:20        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll
2013-06-21 01:20 . 2013-06-21 01:20        158720        ----a-w-        c:\windows\SysWow64\msls31.dll
2013-06-21 01:20 . 2013-06-21 01:20        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2013-06-21 01:20 . 2013-06-21 01:20        138752        ----a-w-        c:\windows\SysWow64\wextract.exe
2013-06-21 01:20 . 2013-06-21 01:20        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2013-06-21 01:20 . 2013-06-21 01:20        12800        ----a-w-        c:\windows\SysWow64\mshta.exe
2013-06-21 01:20 . 2013-06-21 01:20        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2013-06-21 01:20 . 2013-06-21 01:20        97280        ----a-w-        c:\windows\system32\mshtmled.dll
2013-06-21 01:20 . 2013-06-21 01:20        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2013-06-21 01:20 . 2013-06-21 01:20        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll
2013-06-21 01:20 . 2013-06-21 01:20        81408        ----a-w-        c:\windows\system32\icardie.dll
2013-06-21 01:20 . 2013-06-21 01:20        762368        ----a-w-        c:\windows\system32\ieapfltr.dll
2013-06-21 01:20 . 2013-06-21 01:20        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2013-06-21 01:20 . 2013-06-21 01:20        62976        ----a-w-        c:\windows\system32\pngfilt.dll
2013-06-21 01:20 . 2013-06-21 01:20        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx
2013-06-21 01:20 . 2013-06-21 01:20        599552        ----a-w-        c:\windows\system32\vbscript.dll
2013-06-21 01:20 . 2013-06-21 01:20        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll
2013-06-21 01:20 . 2013-06-21 01:20        51200        ----a-w-        c:\windows\system32\imgutil.dll
2013-06-21 01:20 . 2013-06-21 01:20        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2013-06-21 01:20 . 2013-06-21 01:20        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2013-06-21 01:20 . 2013-06-21 01:20        452096        ----a-w-        c:\windows\system32\dxtmsft.dll
2013-06-21 01:20 . 2013-06-21 01:20        441856        ----a-w-        c:\windows\system32\html.iec
2013-06-21 01:20 . 2013-06-21 01:20        361984        ----a-w-        c:\windows\SysWow64\html.iec
2013-06-21 01:20 . 2013-06-21 01:20        281600        ----a-w-        c:\windows\system32\dxtrans.dll
2013-06-21 01:20 . 2013-06-21 01:20        27648        ----a-w-        c:\windows\system32\licmgr10.dll
2013-06-21 01:20 . 2013-06-21 01:20        270848        ----a-w-        c:\windows\system32\iedkcs32.dll
2013-06-21 01:20 . 2013-06-21 01:20        247296        ----a-w-        c:\windows\system32\webcheck.dll
2013-06-21 01:20 . 2013-06-21 01:20        235008        ----a-w-        c:\windows\system32\url.dll
2013-06-21 01:20 . 2013-06-21 01:20        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2013-06-21 01:20 . 2013-06-21 01:20        216064        ----a-w-        c:\windows\system32\msls31.dll
2013-06-21 01:20 . 2013-06-21 01:20        197120        ----a-w-        c:\windows\system32\msrating.dll
2013-06-21 01:20 . 2013-06-21 01:20        173568        ----a-w-        c:\windows\system32\ieUnatt.exe
2013-06-21 01:20 . 2013-06-21 01:20        167424        ----a-w-        c:\windows\system32\iexpress.exe
2013-06-21 01:20 . 2013-06-21 01:20        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl
2013-06-21 01:20 . 2013-06-21 01:20        149504        ----a-w-        c:\windows\system32\occache.dll
2013-06-21 01:20 . 2013-06-21 01:20        144896        ----a-w-        c:\windows\system32\wextract.exe
2013-06-21 01:20 . 2013-06-21 01:20        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2013-06-21 01:20 . 2013-06-21 01:20        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat
2013-06-21 01:20 . 2013-06-21 01:20        13824        ----a-w-        c:\windows\system32\mshta.exe
2013-06-21 01:20 . 2013-06-21 01:20        136192        ----a-w-        c:\windows\system32\iepeers.dll
2013-06-21 01:20 . 2013-06-21 01:20        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll
2013-06-21 01:20 . 2013-06-21 01:20        12800        ----a-w-        c:\windows\system32\msfeedssync.exe
2013-06-21 01:20 . 2013-06-21 01:20        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2013-06-21 01:20 . 2013-06-21 01:20        102912        ----a-w-        c:\windows\system32\inseng.dll
2013-06-21 01:20 . 2013-06-21 01:20        77312        ----a-w-        c:\windows\system32\tdc.ocx
2013-05-13 13:36 . 2013-05-13 13:36        862664        ----a-w-        c:\windows\SysWow64\msvcr110.dll
2013-05-13 13:36 . 2013-05-13 13:36        828872        ----a-w-        c:\windows\system32\msvcr110.dll
2013-05-13 13:36 . 2013-05-13 13:36        661448        ----a-w-        c:\windows\system32\msvcp110.dll
2013-05-13 13:36 . 2013-05-13 13:36        534480        ----a-w-        c:\windows\SysWow64\msvcp110.dll
2013-05-13 13:36 . 2013-05-13 13:36        354264        ----a-w-        c:\windows\system32\vccorlib110.dll
2013-05-13 13:36 . 2013-05-13 13:36        251864        ----a-w-        c:\windows\SysWow64\vccorlib110.dll
2013-05-13 13:36 . 2013-05-13 13:36        50864        ----a-w-        c:\windows\system32\drivers\point64.sys
2013-05-13 13:36 . 2013-05-13 13:36        2274480        ----a-w-        c:\windows\system32\coin94.dll
2013-05-13 05:51 . 2013-06-12 20:07        184320        ----a-w-        c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-12 20:07        1464320        ----a-w-        c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-12 20:07        139776        ----a-w-        c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-12 20:07        52224        ----a-w-        c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-12 20:07        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll
2013-05-13 04:45 . 2013-06-12 20:07        1160192        ----a-w-        c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-12 20:07        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll
2013-05-13 03:43 . 2013-06-12 20:07        1192448        ----a-w-        c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 20:07        903168        ----a-w-        c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-12 20:07        43008        ----a-w-        c:\windows\SysWow64\certenc.dll
2013-05-10 05:49 . 2013-06-12 20:07        30720        ----a-w-        c:\windows\system32\cryptdlg.dll
2013-05-10 03:20 . 2013-06-12 20:07        24576        ----a-w-        c:\windows\SysWow64\cryptdlg.dll
2013-05-08 06:39 . 2013-06-12 20:07        1910632        ----a-w-        c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184]
"Bitdefender-Geldbörse-Agent"="c:\program files\Bitdefender\Bitdefender\pmbxag.exe" [2013-06-19 520496]
"Bitdefender-Geldbörse"="c:\program files\Bitdefender\Bitdefender\pwdmanui.exe" [2013-06-20 971136]
"Bitdefender-Geldbörse-Anwendungs-Agent"="c:\program files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe" [2013-06-19 609576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2013-04-25 1075296]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-05-20 450560]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-02-13 1263952]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Bitdefender-Geldbörse-Agent"="c:\program files\Bitdefender\Bitdefender\pmbxag.exe" [2013-06-19 520496]
"Bitdefender-Geldbörse"="c:\program files\Bitdefender\Bitdefender\pwdmanui.exe" [2013-06-20 971136]
"Bitdefender-Geldbörse-Anwendungs-Agent"="c:\program files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe" [2013-06-19 609576]
.
c:\users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 bdfwfpf_pc;bdfwfpf_pc;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [x]
R3 BDSandBox;BDSandBox;c:\windows\system32\drivers\bdsandbox.sys;c:\windows\SYSNATIVE\drivers\bdsandbox.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R4 BdDesktopParental;Bitdefender Desktop Parental Control;c:\program files\Bitdefender\Bitdefender\bdparentalservice.exe;c:\program files\Bitdefender\Bitdefender\bdparentalservice.exe [x]
S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys;c:\windows\SYSNATIVE\DRIVERS\avc3.sys [x]
S0 gzflt;gzflt;c:\windows\system32\DRIVERS\gzflt.sys;c:\windows\SYSNATIVE\DRIVERS\gzflt.sys [x]
S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [x]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 MSSQL$ZOOM;SQL Server (ZOOM);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe;c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [x]
S2 UnsignedThemes;Unsigned Themes;c:\windows\UnsignedThemesSvc.exe;c:\windows\UnsignedThemesSvc.exe [x]
S2 UPDATESRV;Bitdefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender\updatesrv.exe;c:\program files\Bitdefender\Bitdefender\updatesrv.exe [x]
S2 uxpatch;uxpatch;c:\windows\system32\drivers\uxpatch.sys;c:\windows\SYSNATIVE\drivers\uxpatch.sys [x]
S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys;c:\windows\SYSNATIVE\DRIVERS\avchv.sys [x]
S3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys;c:\windows\SYSNATIVE\DRIVERS\avckf.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-31 23:02        1173456        ----a-w-        c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
c:\windows\Tasks\Adobe Flash Player Updater.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
"Bdagent"="c:\program files\Bitdefender\Bitdefender\bdagent.exe" [2013-06-27 1716832]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-08-02  18:12:31
ComboFix-quarantined-files.txt  2013-08-02 16:12
.
Vor Suchlauf: 8 Verzeichnis(se), 447.427.891.200 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 447.289.606.144 Bytes frei
.
- - End Of File - - E48DB6D7D13FA1A405D0FFDB86310C94
A36C5E4F47E84449FF07ED3517B43A31

und das von malware:

Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.02.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16635
Daniel :: DANIEL-PC [Administrator]

02.08.2013 18:16:08
mbam-log-2013-08-02 (18-16-08).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 378990
Laufzeit: 52 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 11
C:\Program Files\Adobe\Adobe Illustrator CS6 (64 Bit)\Support Files\Contents\Windows\amtlib.dll (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)\amtlib.dll (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Adobe\Adobe Photoshop CS6\amtlib.dll (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\LWA\amtlib.dll (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\amtlib.dll (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Daniel\Downloads\NimbusSansBeckerDiaD_downloader_by_Fonts101.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Programme\Adobe Illustrator\Adobe.Illustrator.CS6.v8.0.LS4.Multilanguage-PillePalle\Crack\32-bit\amtlib.dll (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Programme\Adobe Illustrator\Adobe.Illustrator.CS6.v8.0.LS4.Multilanguage-PillePalle\Crack\64-bit\amtlib.dll (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Programme\Adobe.Dreamweaver.CS6.v12.0.LS4.Multilanguage\Crack\32-bit\amtlib.dll (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Programme\Adobe.Dreamweaver.CS6.v12.0.LS4.Multilanguage\Crack\64-bit\amtlib.dll (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Programme\Corel Draw X6\x32_CDGS_16.2.0.998_de\Keymaker-CORE\keygen.exe (RiskWare.Tool.HCK) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

markusg 02.08.2013 18:29
Hi,
es sind 3 Logs zu erstellen, poste diese möglichst gleichzeitig.
1.
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Neustarten.
2.

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


neustarten.
3.
HitmanPro - Download - Filepony
Hitmanpro bitte laden, Scan klicken.
Log speichern und posten, bzw als XML exportieren, packen und anhängen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:23 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131